Vulnerabilidades em makeplane
62 resultadosAnálise Vexday
O Makeplane apresenta 16 vulnerabilidades catalogadas, sendo 2 críticas, sem registros de exploração ativa em campo. A fraqueza dominante é requisição forjada do lado do servidor (CWE-918), um vetor de risco moderado para ambientes conectados. Com apenas 2 divulgações nos últimos 90 dias, o panorama sugere risco estável e de baixa urgência operacional.
CVE-2025-48070LOWPlane has insecure permissions in UserSerializerEPSS 0.3%CVE-2026-104973HIGHPlane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook DeliveryEPSS 0.3%CVE-2026-104969MEDIUMPlane: Cross-Tenant Cycle Issue Hijack via IDOREPSS 0.3%CVE-2026-104970HIGHPlane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance adminsEPSS 0.3%CVE-2026-104975HIGHPlane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpointsEPSS 0.3%CVE-2026-104893MEDIUMPlane: Improper validation allows arbitrary modification of API token rate limitsEPSS 0.3%CVE-2026-105629HIGHPlane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key LookupEPSS 0.2%CVE-2026-104976HIGHPlane: SSRF in Gitea OAuthEPSS 0.2%CVE-2026-104966HIGHPlane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across WorkspacesEPSS 0.2%CVE-2026-104892HIGHPlane: Plaintext logging of API tokenEPSS 0.2%CVE-2026-102988MEDIUMPlane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)EPSS 0.2%CVE-2026-104894MEDIUMPlane: Cross-Tenant Module Issue Linking via IDOREPSS 0.2%CVE-2026-105631HIGHPlane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosureEPSS 0.2%CVE-2026-104965MEDIUMPlane: Cross-Tenant Issue Relation Creation via IDOREPSS 0.2%CVE-2026-105630HIGHPlane: Stored XSS via SVG attachment served inline on the application origin (account takeover)EPSS 0.2%CVE-2025-55203MEDIUMPlane Stored XSS in Add Work Item FunctionalityEPSS 0.2%CVE-2026-102981MEDIUMPlane: Unauthenticated Workspace Invitation Token LeakageEPSS 0.2%CVE-2026-104963MEDIUMPlane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace memberEPSS 0.2%CVE-2025-69284MEDIUMIn plane.io, a Guest User to a Workspace can still be able to see list of membersEPSS 0.2%CVE-2026-104955MEDIUMPlane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)EPSS 0.2%